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Our ref: PDF 0312/02 (PCT) - Reverse Variable Authentication Timeout 



We refer to the Written Opinion of the ISA issued with the International Search 
Report of 15 June 2005. 



The Written Opinion states that the subject matter of the claims lacks novelty 
and inventive step over WO 03/007570 (D1). The Applicant respectfully 
refutes the views as set out in the Written Opinion. 

Document D1 describes a system for processing encrypted messages on a 
mobile device. At the mobile device, the information required to access the 
encrypted message, is received and stored into memory. When encrypted 
content is to be decrypted, the encryption accessing information Is retrieved 
from memory. In essence, this encryption accessing information is the 
decrypted session key. and on page 16 paragraph 2. the document discloses 
that the decrypted key may be stored for only a particular period of time, 
which may be set by the user of the device. Hence, more sensitive messages 
from particular addressees may have a relative short decrypted session key 
storage period, whereas messages from personal contacts may be accorded 
a longer decrypted session key storage period. The document also describes 
how particular mail content, such as wording in the subject line, may be used 
to control the decrypted session key storage period. 
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The system described in D1 Is therefore concerned with authorising 
something (the decrypted session l^ey) for a particular period of time following 
the current authentication. The system described in D1 is able to authorise 
the session key for a particular period of time because it is only concerned 
about unlocking encryption keys and does not attempt in any way whatsoever 
to anticipate in advance all the operations for which a user might require 
authentication; the passage on page 16 of D1 referred to In the Opinion is only 
concerned with one operation of the user, which is accessing and reading 



mail. 



This is in strict contrast to the present invention, which assesses the 
'freshness' of the authentication of the identity of the user at the time the 
user requires to perform a specific action on the device. Whether or not the 
user is then able to carry out a desired operation depends upon the nature of 
the operation and the 'freshness' of the authentication of the identity of the 
user. The present invention accounts, therefore, for various actions or 
operations which can be performed on the device by a user and sets 
authentication freshness criteria for the possible actions or operations. There 
is no hint whatsoever of this method of device operation in the system 
described in D1. 

Accordingly, it is submitted that the invention as claimed does constitute 
subject matter which meets the criteria of Article 33(1) PCT. 

In order to clarify the technical nature of this invention, the claims of the 
application have been redrafted and are now directed to a method of 
operating a computing device, and not to a method of communicating 
information between computing devices Accordingly, a replacement set of 
claims is filed herewith. 

In the light of the above arguments and amendments, re-consideration of the 
present application is requested. A Demand for Preliminary Examination of 
this application is being filed concurrently herewith. Should the examiner 
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require further clarification resulting from such Preliminary Examination, a 
further Written Opinion is requested. 



Yours faithfully, 





Gino Sorenti 
Agent for the Applicants 
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